https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8838

diff --git a/ChangeLog b/ChangeLog
index 0a87ed0c56d6311e3e59462408a35927cd3e4de5..819a32ac3c1460057ff09bbe4df0c0611362c74a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2018-06-11  7.0.8-0  <quetzlzacatenango@image...>
+  * Fixed numerous use of uninitialized values, integer overflow, memory
+    exceeded, and timeouts (credit to OSS Fuzz).
+
 2018-06-11  7.0.7-39 Cristy  <quetzlzacatenango@image...>
   * Release ImageMagick version 7.0.7-39, GIT revision 14445:cc962acde:20180611.
 

diff --git a/MagickCore/draw.c b/MagickCore/draw.c
index d3f9f9984423ab88a43f3912970a043101ea178a..17741ea23a99c3af205d7d2c646e7f655e41a9f1 100644 (file)
--- a/MagickCore/draw.c
+++ b/MagickCore/draw.c
@@ -2217,9 +2217,11 @@ static MagickBooleanType CheckPrimitiveExtent(MVGInfo *mvg_info,
     return(MagickTrue);
   *mvg_info->primitive_info=ResizeQuantumMemory(*mvg_info->primitive_info,
     extent,sizeof(**mvg_info->primitive_info));
-  *mvg_info->extent=extent;
   if (*mvg_info->primitive_info != (PrimitiveInfo *) NULL)
-    return(MagickTrue);
+    {
+      *mvg_info->extent=extent;
+      return(MagickTrue);
+    }
   /*
     Reallocation failed, allocate a primitive to facilitate unwinding.
   */
@@ -4247,9 +4249,11 @@ MagickExport MagickBooleanType DrawImage(Image *image,const DrawInfo *draw_info,
   if (primitive_info != (PrimitiveInfo *) NULL)
     {
       for (i=0; primitive_info[i].primitive != UndefinedPrimitive; i++)
-        if (primitive_info[i].text != (char *) NULL)
-          primitive_info[i].text=(char *) RelinquishMagickMemory(
-            primitive_info[i].text);
+        if ((primitive_info[i].primitive == TextPrimitive) ||
+            (primitive_info[i].primitive == ImagePrimitive))
+          if (primitive_info[i].text != (char *) NULL)
+            primitive_info[i].text=(char *) RelinquishMagickMemory(
+              primitive_info[i].text);
       primitive_info=(PrimitiveInfo *) RelinquishMagickMemory(primitive_info);
     }
   primitive=DestroyString(primitive);